feat: add ALIAS_DOMAIN / SAN support for all DNS providers

[cl4wb0t]

Summary

Adds ALIAS_DOMAIN environment variable support to dstack-ingress. When set:

• certbot issues a SAN certificate covering both DOMAIN and ALIAS_DOMAIN (via --cert-name + --expand -d)
• nginx server_name includes ALIAS_DOMAIN so requests arriving via either hostname are accepted

This works with all DNS providers (Cloudflare, Linode, Namecheap, Route53) — no provider-specific code needed.

New Environment Variable

Variable	Required	Description
ALIAS_DOMAIN	No	Additional domain included as a SAN on the TLS cert and in nginx server_name

Files Changed

File	Change
scripts/certman.py	Add --cert-name, --expand -d alias_domain to certbot command
scripts/entrypoint.sh	Sanitize ALIAS_DOMAIN, include in nginx server_name
DNS_PROVIDERS.md	Document ALIAS_DOMAIN in optional variables
README.md	Document ALIAS_DOMAIN env var

Test plan

• Set ALIAS_DOMAIN=alias.example.com — verify cert has SAN for both domains
• Verify nginx server_name includes both domains
• Without ALIAS_DOMAIN — verify behavior identical to before
• Test with Cloudflare and Route53 providers

Cherry-picked from Dstack-TEE/dstack-examples#83
Tracks: CPL-139

🤖 Generated with Claude Code

[cl4wb0t]

Superseded by upstream Dstack-TEE#86

Note: upstream PR Dstack-TEE#86 has the alias_domain / --cert-name / --expand block outside the if action == "certonly": guard, so those flags would also be appended to certbot renew commands (which don't accept them). This PR had them correctly scoped inside the certonly branch.